Question 1

Is Octopus Deploy SOC 2 compliant?

Accepted Answer

Octopus Deploy is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Octopus Deploy ISO 27001 certified?

Accepted Answer

According to Octopus Deploy's public trust center, Octopus Deploy is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Is Octopus Deploy SOC 3 compliant?

Accepted Answer

According to Octopus Deploy's public trust center, Octopus Deploy is SOC 3 compliant. On SOC2C this listing is Listed.

Question 4

Is Octopus Deploy GDPR compliant?

Accepted Answer

According to Octopus Deploy's public trust center, Octopus Deploy is GDPR compliant. On SOC2C this listing is Listed.

Question 5

Is Octopus Deploy CCPA compliant?

Accepted Answer

According to Octopus Deploy's public trust center, Octopus Deploy is CCPA compliant. On SOC2C this listing is Listed.

Question 6

Is Octopus Deploy PCI DSS compliant?

Accepted Answer

According to Octopus Deploy's public trust center, Octopus Deploy is PCI DSS compliant. On SOC2C this listing is Listed.

Question 7

Is Octopus Deploy SOC 2 Type I or Type II?

Accepted Answer

Octopus Deploy is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 8

Can I use Octopus Deploy's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Octopus Deploy's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 9

Is Octopus Deploy penetration tested?

Accepted Answer

Octopus Deploy hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 10

Is Octopus Deploy secure?

Accepted Answer

Security isn't a single yes/no, but Octopus Deploy is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, SOC 3, GDPR, CCPA, PCI DSS. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 11

Does Octopus Deploy have a bug bounty or vulnerability disclosure program?

Accepted Answer

Octopus Deploy hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@octopus.com or via a /security page (Octopus Deploy lists a security contact).

Question 12

Who are Octopus Deploy's subprocessors?

Accepted Answer

Octopus Deploy lists 41 subprocessors on its trust center, including Microsoft Azure, Google, SalesForce, Zendesk, Amazon Web Services. Buyers use this for fourth-party risk review.

Question 13

Where does Octopus Deploy host or store data?

Accepted Answer

Octopus Deploy hosts on AWS, Azure, and handles Credit card information, Personal health information, Customer Intellectual Property (configuration & scripts you upload to our service), Customer Personal Data (Name, email and billing address information). Data residency details are on its trust center.

Question 14

Where is Octopus Deploy's trust center or security page?

Accepted Answer

Octopus Deploy's trust center is at https://trust.octopus.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 15

What's the difference between Octopus Server and Octopus Cloud?

Accepted Answer

Octopus Server is hosted within your own environment (on premise), while Octopus Cloud is hosted in the cloud, in a region of your choosing. We designed both products to provide the same functionality. If you are using the Octopus Server product, you are taking responsibility for the security and integrity of the Octopus Server, which includes things like file storage, database protection, and the security of the underlying operating system. You can find information about secure configuration of the Octopus Server product on our website.

Question 16

How long do you retain log data for?

Accepted Answer

We keep security logs for at least 12 months, this helps us perform the necessary forensic investigations in the unlikely event of a security incident. This is also done in order for us to meet ISO27001 & SOC II cybersecurity standards.

Question 17

How does Octopus Cloud approach credential management?

Accepted Answer

Here at Octopus we pride ourselves on taking industry standards and current thinking in the cybersecurity space and applying them in our environment. We make use of MFA across the board, use password management tooling, do realtime access review as well as quarterly formal reviews, and we enforce strict password policies for all production environments. Our production environment is entirely segregated from any development and testing environments, and all of our highly skilled engineers have undergone specialist security training, and thorough background checks.

Question 18

What is your incident response plan and process?

Accepted Answer

We have a fully documented Security Incident Response Plan (SIRP). Staff are trained in executing this plan and tabletop exercises are used to test the plan. We have a dedicated team of in-house specialists for security incident response. We used principles from FIRST and their PSIRT services framework to design our SIRP. https://www.first.org/standards/frameworks/psirts/psirt_services_framework_v1.1

Question 19

What support do you offer to clients in the event of a security incident?

Accepted Answer

We are deeply invested in our customers success and will do what we can to provide you with any information we have with regards to security incidents related to your Octopus Deploy instance. We do not provide any specific security support services in the event of a security incident on your end. However, we are more than happy to assist with providing you with the maximum amount of detail we can provide you to assist with any forensic or analytical investigations you may need to perform. For Cloud customers this means we are able to provide application logging and security logs if required for your analysis. Please keep in mind that on-premise installations are self contained, and we do not keep any standing access to it, so our ability to provide forensic details will be limited, however we are available to advise you on how our product is intended to work, and share code where required to help you properly understand Octopus Server at runtime. If there is a security incident with our products we will inform and involve affected customers as soon as it is safe and practical to do so, while complying with any relevant cybersecurity incident notification reporting laws (e.g. GDPR notification timelines). We reach out to the administrators on file via our support teams.

Question 20

What certifications do you have that relate to security incident management?

Accepted Answer

Our ISO27001 certification and SOC II Reports require us to undergo independant audits against a variety of security controls which include reviewing all of our security incidents and their management practices against our policies and procedures.

Question 21

When will the 2025 Certificates of Currency be available?

Accepted Answer

We are currently awaiting our insurers providing us formal certificates of currency for our 2025-26 policies. We will update as soon as these certificates are received, which we expect in May 2025. We regret any inconvenience this may cause.

Octopus Deploy

About

Compliance & infrastructure

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Business & Industrial peers that completed SOC 2

Newsworthy.ai

1099-Prep

Ask Ai

BetterCloud